Hello everyone,

Boreal Cryptosystems (Quebec, Canada) has just released the first public version of Fe11, an open-source PKCS#11 library written in Rust and licensed under Apache 2.0.

Why Fe11?

Fe11 is a deliberately opinionated library, designed around a strict interpretation of PKCS#11 contracts and semantics, from versions 2.40 through 3.2. The goal is not simply to expose native functions through a Rust interface, but to provide a comprehensive architecture that addresses the requirements and constraints of the standard, particularly regarding resource management, lifecycles, and operation behavior.

Features and Scope

Fe11 supports classical cryptographic operations as well as post-quantum mechanisms introduced in recent versions of PKCS#11, including ML-KEM, ML-DSA, and SLH-DSA.

The library is vendor-agnostic and relies on the capabilities actually exposed by the selected native module. It preserves the interfaces and contracts defined by PKCS#11 specifications 2.40 through 3.2. Some features, notably native asynchronous execution introduced in PKCS#11 3.2, are not yet enabled.

The architecture consists of several components:

  • fe11: Core library providing Rust interfaces, cryptographic operations, and resource management.

  • fe11-sys: Native PKCS#11 declarations and ABI bindings.

  • fe11-verify-engine-api: Versioned C interface for the optional verification component.

  • fe11-verify-engine: Optional component for software-based signature verification and hashing, explicitly selected by the application, with no implicit fallback.

Initial Release for Community Review

Fe11 0.1.0 is an initial release intended for community review.

The repository includes the source code, API documentation, usage examples, and detailed descriptions of operation contracts, security boundaries, and recovery mechanisms.

Boreal Cryptosystems welcomes all feedback and observations. Interoperability testing with different PKCS#11 implementations is also highly encouraged.

Technical criticism and contributions are welcome.

Links

Thank you to everyone who takes the time to explore the project and share their feedback.

1 post - 1 participant

Read full topic